@Albin is completely right, do not stop the progress, just wait for the image to finish.
Once you have an image of the disk, assuming you are unable to access the files the normal way, here is how you can go on about recovering the files from it (will include deleted files too):
There are plenty of recovery applications, personally I find that photorec
and foremost
work best. You already have photorec, foremost can be installed from the foremost
package.
a) Photorec
Simply run $ photorec image.dd
now to open up photorec's interactive interface.
Hit return ([Proceed]
) to select the disk image. In the next screen, you're asked to select a partition. If photorec finds the correct partitions, you can select the one you want to recover the files from here. If it doesn't detect the partitions properly, simply select No partition [Whole disk]
and hit return again to perform the [Search]
. Once selected the filesystem type in the next screen, you need to select a directory in which the recovered files should be saved. Confirm with C
.
b) Foremost
While photorec works by trying to find "data blocks" of the drive and media within using file carving, foremost does it a bit differently. It's still using the file carving concept but it ignores the type of underlying filesystem and directly works by copying segments of the drive into your RAM, which is then being scanned for file header types. Foremost comes with a lot of built-in headers to recover most types of common files, if you want to add custom headers/footers to detect less common file types, foremost offers you this ability.
To run foremost using the default options on the image, run the following command:
$ foremost -i image.dd -v
That will save all recovered files into output
(new directory that foremost will create). You can specify another output directory using the -o
flag, and -a
to ignore errors/save corrupted files.
Optional: Filter the recovered files
This is optional, but sometimes you are only interested in specific types of files, or even worse: Recovery tools give you a million of files out of which thousands appear to be, for example, a JPEG file, but in reality it's just a corrupted file and not a picture at all. To filter these out you can use this answer I gave to another question on SuperUser.
Similar question where the tool is
ddrescue
. – Kamil Maciorowski – 2018-08-14T07:15:19.550